NAID-3322 - Review GitHub Actions NHS Best Practices #310
Conversation
MartinWheelerMT
force-pushed
the
niad-3332-review-github-actions
branch
from
2161d32 to
240b1d2
Compare
* Restrict permissions per job to ensure that only the least required permissions are granted in `build` workflow. * Use SHAs for GitHub Actions `actions` instead of versions to ensure we have control over exactly which version is being used in `build` workflow.
MartinWheelerMT
force-pushed
the
niad-3332-review-github-actions
branch
from
240b1d2 to
4f49f52
Compare
|
Images built and published to ECR using a Build Id of PR-103-9e7d7aa |
MartinWheelerMT
force-pushed
the
niad-3332-review-github-actions
branch
from
759ead0 to
0a164de
Compare
MartinWheelerMT
force-pushed
the
niad-3332-review-github-actions
branch
from
0a164de to
57a442e
Compare
* Update GitHub Action `actions` to use a named SHA rather than major version as suggested by best practices.
* Removed unneeded in `input` for `publish` job.
| steps: | ||
| - name: Checkout Repository | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
There was a problem hiding this comment.
does not actions/checkout@v4 take the latest version? I am just trying to understand why do we need to pull "checkout@11bd71901bbe5b1630ceea73d27597364c9af683" ? looks a bit scary :) ....
There was a problem hiding this comment.
To ensure a specific version is used and prevent the latest version being used in case of malicious updates or security issues with introduced dependencies.
Please see: Pin actions to specific versions
| steps: | ||
| - name: Comment PR | ||
| uses: thollander/actions-comment-pull-request@v3 | ||
| uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 |
There was a problem hiding this comment.
the same here as above... doesn't "thollander/actions-comment-pull-request@v3" take the latest version ? or we need specifically v.3.0.1 ?
There was a problem hiding this comment.
To ensure a specific version is used and prevent the latest version being used in case of malicious updates or security issues with introduced dependencies.
Please see: Pin actions to specific versions
3 participants
buildworkflow.actionsinstead of versions to ensure we have control over exactly which version is being used inbuildworkflow.id-tokenwrite permissions fromintegration_testsjob.id-tokenwrite permissions frombuild-and-publish-docker-imagejob.